Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
polishclub.exe
-
Size
34KB
-
Sample
240928-x9dhbavhrg
-
MD5
8a1e00f00d6ac52747aa1dbeeb6afe8f
-
SHA1
8628de10d78a09956d1af140ba9ef3ebd19c02b1
-
SHA256
cfe0edec47b69e6806e6d19a7aab72b4c952efd5ca993e64ee3da44a99456a4d
-
SHA512
dec65379bdd78d6c35e1669e33a6acf1bb6666ab594ce9fc88b50e222fc356601ac84b918eabe74538d349067060fdc143ed4f77005a103947908cb3b015fde6
-
SSDEEP
384:ASyXlquOae6oKoBmoDnnGvBLmlgCwvHixdTD2VR8pkFTBLTIZwYGDcvw9IkuisRN:3yXiBDAtYgC4CaV9FZ9jENLOjho/4g
Behavioral task
behavioral1
Sample
polishclub.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
polishclub.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
polishclub.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
polishclub.exe
Resource
win11-20240802-en
Malware Config
Extracted
xworm
5.0
lefferek-42016.portmap.host:61672
budget-compiled.gl.at.ply.gg:61672
BaJPVrZJtjd9S7m2
-
Install_directory
%AppData%
-
install_file
DiscordClient.exe
Targets
-
-
Target
polishclub.exe
-
Size
34KB
-
MD5
8a1e00f00d6ac52747aa1dbeeb6afe8f
-
SHA1
8628de10d78a09956d1af140ba9ef3ebd19c02b1
-
SHA256
cfe0edec47b69e6806e6d19a7aab72b4c952efd5ca993e64ee3da44a99456a4d
-
SHA512
dec65379bdd78d6c35e1669e33a6acf1bb6666ab594ce9fc88b50e222fc356601ac84b918eabe74538d349067060fdc143ed4f77005a103947908cb3b015fde6
-
SSDEEP
384:ASyXlquOae6oKoBmoDnnGvBLmlgCwvHixdTD2VR8pkFTBLTIZwYGDcvw9IkuisRN:3yXiBDAtYgC4CaV9FZ9jENLOjho/4g
-
Detect Xworm Payload
-
StormKitty payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates processes with tasklist
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1